vforclaude2 0.3.87

package/open-sse/executors/default.js

@@ -0,0 +1,213 @@
+import { BaseExecutor } from "./base.js";
+import { PROVIDERS } from "../config/providers.js";
+import { OAUTH_ENDPOINTS, buildKimiHeaders } from "../config/appConstants.js";
+import { buildClineHeaders } from "../../src/shared/utils/clineAuth.js";
+
+export class DefaultExecutor extends BaseExecutor {
+  constructor(provider) {
+    super(provider, PROVIDERS[provider] || PROVIDERS.openai);
+  }
+
+  buildUrl(model, stream, urlIndex = 0, credentials = null) {
+    if (this.provider?.startsWith?.("openai-compatible-")) {
+      const baseUrl = credentials?.providerSpecificData?.baseUrl || "https://api.openai.com/v1";
+      const normalized = baseUrl.replace(/\/$/, "");
+      const path = this.provider.includes("responses") ? "/responses" : "/chat/completions";
+      return `${normalized}${path}`;
+    }
+    if (this.provider?.startsWith?.("anthropic-compatible-")) {
+      const baseUrl = credentials?.providerSpecificData?.baseUrl || "https://api.anthropic.com/v1";
+      const normalized = baseUrl.replace(/\/$/, "");
+      return `${normalized}/messages`;
+    }
+    switch (this.provider) {
+      case "claude":
+      case "glm":
+      case "kimi":
+      case "minimax":
+      case "minimax-cn":
+        return `${this.config.baseUrl}?beta=true`;
+      case "kimi-coding":
+        return `${this.config.baseUrl}?beta=true`;
+      case "gemini":
+        return `${this.config.baseUrl}/${model}:${stream ? "streamGenerateContent?alt=sse" : "generateContent"}`;
+      default:
+        return this.config.baseUrl;
+    }
+  }
+
+  buildHeaders(credentials, stream = true) {
+    const headers = { "Content-Type": "application/json", ...this.config.headers };
+
+    switch (this.provider) {
+      case "gemini":
+        credentials.apiKey ? headers["x-goog-api-key"] = credentials.apiKey : headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+        break;
+      case "claude":
+        credentials.apiKey ? headers["x-api-key"] = credentials.apiKey : headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+        break;
+      case "glm":
+      case "kimi":
+      case "minimax":
+      case "minimax-cn":
+        headers["x-api-key"] = credentials.apiKey || credentials.accessToken;
+        break;
+      case "kimi-coding":
+        headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+        Object.assign(headers, buildKimiHeaders());
+        break;
+      default:
+        if (this.provider?.startsWith?.("anthropic-compatible-")) {
+          if (credentials.apiKey) {
+            headers["x-api-key"] = credentials.apiKey;
+          } else if (credentials.accessToken) {
+            headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+          }
+          if (!headers["anthropic-version"]) {
+            headers["anthropic-version"] = "2023-06-01";
+          }
+        } else if (this.provider === "kilocode") {
+          headers["Authorization"] = `Bearer ${credentials.apiKey || credentials.accessToken}`;
+          if (credentials.providerSpecificData?.orgId) {
+            headers["X-Kilocode-OrganizationID"] = credentials.providerSpecificData.orgId;
+          }
+        } else if (this.provider === "cline") {
+          Object.assign(headers, buildClineHeaders(credentials.apiKey || credentials.accessToken));
+        } else {
+          headers["Authorization"] = `Bearer ${credentials.apiKey || credentials.accessToken}`;
+        }
+    }
+
+    if (stream) headers["Accept"] = "text/event-stream";
+    return headers;
+  }
+
+  async refreshCredentials(credentials, log) {
+    if (!credentials.refreshToken) return null;
+
+    const refreshers = {
+      claude: () => this.refreshWithJSON(OAUTH_ENDPOINTS.anthropic.token, { grant_type: "refresh_token", refresh_token: credentials.refreshToken, client_id: PROVIDERS.claude.clientId }),
+      codex: () => this.refreshWithForm(OAUTH_ENDPOINTS.openai.token, { grant_type: "refresh_token", refresh_token: credentials.refreshToken, client_id: PROVIDERS.codex.clientId, scope: "openid profile email offline_access" }),
+      qwen: () => this.refreshWithForm(OAUTH_ENDPOINTS.qwen.token, { grant_type: "refresh_token", refresh_token: credentials.refreshToken, client_id: PROVIDERS.qwen.clientId }),
+      iflow: () => this.refreshIflow(credentials.refreshToken),
+      gemini: () => this.refreshGoogle(credentials.refreshToken),
+      kiro: () => this.refreshKiro(credentials.refreshToken),
+      cline: () => this.refreshCline(credentials.refreshToken),
+      "kimi-coding": () => this.refreshKimiCoding(credentials.refreshToken),
+      kilocode: () => this.refreshKilocode(credentials.refreshToken)
+    };
+
+    const refresher = refreshers[this.provider];
+    if (!refresher) return null;
+
+    try {
+      const result = await refresher();
+      if (result) log?.info?.("TOKEN", `${this.provider} refreshed`);
+      return result;
+    } catch (error) {
+      log?.error?.("TOKEN", `${this.provider} refresh error: ${error.message}`);
+      return null;
+    }
+  }
+
+  async refreshWithJSON(url, body) {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "Accept": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) return null;
+    const tokens = await response.json();
+    return { accessToken: tokens.access_token, refreshToken: tokens.refresh_token || body.refresh_token, expiresIn: tokens.expires_in };
+  }
+
+  async refreshWithForm(url, params) {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
+      body: new URLSearchParams(params)
+    });
+    if (!response.ok) return null;
+    const tokens = await response.json();
+    return { accessToken: tokens.access_token, refreshToken: tokens.refresh_token || params.refresh_token, expiresIn: tokens.expires_in };
+  }
+
+  async refreshIflow(refreshToken) {
+    const basicAuth = btoa(`${PROVIDERS.iflow.clientId}:${PROVIDERS.iflow.clientSecret}`);
+    const response = await fetch(OAUTH_ENDPOINTS.iflow.token, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json", "Authorization": `Basic ${basicAuth}` },
+      body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: PROVIDERS.iflow.clientId, client_secret: PROVIDERS.iflow.clientSecret })
+    });
+    if (!response.ok) return null;
+    const tokens = await response.json();
+    return { accessToken: tokens.access_token, refreshToken: tokens.refresh_token || refreshToken, expiresIn: tokens.expires_in };
+  }
+
+  async refreshGoogle(refreshToken) {
+    const response = await fetch(OAUTH_ENDPOINTS.google.token, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
+      body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: this.config.clientId, client_secret: this.config.clientSecret })
+    });
+    if (!response.ok) return null;
+    const tokens = await response.json();
+    return { accessToken: tokens.access_token, refreshToken: tokens.refresh_token || refreshToken, expiresIn: tokens.expires_in };
+  }
+
+  async refreshKiro(refreshToken) {
+    const response = await fetch(PROVIDERS.kiro.tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "Accept": "application/json", "User-Agent": "kiro-cli/1.0.0" },
+      body: JSON.stringify({ refreshToken })
+    });
+    if (!response.ok) return null;
+    const tokens = await response.json();
+    return { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken || refreshToken, expiresIn: tokens.expiresIn };
+  }
+
+  async refreshCline(refreshToken) {
+    console.log('[DEBUG] Refreshing Cline token, refreshToken length:', refreshToken?.length);
+    const response = await fetch("https://api.cline.bot/api/v1/auth/refresh", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "Accept": "application/json" },
+      body: JSON.stringify({ refreshToken, grantType: "refresh_token", clientType: "extension" })
+    });
+    console.log('[DEBUG] Cline refresh response status:', response.status);
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.log('[DEBUG] Cline refresh error:', errorText);
+      return null;
+    }
+    const payload = await response.json();
+    console.log('[DEBUG] Cline refresh payload:', JSON.stringify(payload).substring(0, 200));
+    const data = payload?.data || payload;
+    const expiresAtIso = data?.expiresAt;
+    const expiresIn = expiresAtIso ? Math.max(1, Math.floor((new Date(expiresAtIso).getTime() - Date.now()) / 1000)) : undefined;
+    console.log('[DEBUG] Cline refresh success, expiresIn:', expiresIn);
+    return { accessToken: data?.accessToken, refreshToken: data?.refreshToken || refreshToken, expiresIn };
+  }
+
+  async refreshKimiCoding(refreshToken) {
+    const kimiHeaders = buildKimiHeaders();
+    const response = await fetch("https://auth.kimi.com/api/oauth/token", {
+      method: "POST",
+      headers: { 
+        "Content-Type": "application/x-www-form-urlencoded", 
+        "Accept": "application/json",
+        ...kimiHeaders
+      },
+      body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: "17e5f671-d194-4dfb-9706-5516cb48c098" })
+    });
+    if (!response.ok) return null;
+    const tokens = await response.json();
+    return { accessToken: tokens.access_token, refreshToken: tokens.refresh_token || refreshToken, expiresIn: tokens.expires_in };
+  }
+
+  async refreshKilocode(refreshToken) {
+    // Kilocode uses device code flow, no refresh token support
+    return null;
+  }
+}
+
+export default DefaultExecutor;

package/open-sse/executors/gemini-cli.js

@@ -0,0 +1,67 @@
+import { BaseExecutor } from "./base.js";
+import { PROVIDERS } from "../config/providers.js";
+import { OAUTH_ENDPOINTS, GEMINI_CLI_API_CLIENT, geminiCLIUserAgent } from "../config/appConstants.js";
+
+export class GeminiCLIExecutor extends BaseExecutor {
+  constructor() {
+    super("gemini-cli", PROVIDERS["gemini-cli"]);
+  }
+
+  buildUrl(model, stream, urlIndex = 0) {
+    const action = stream ? "streamGenerateContent?alt=sse" : "generateContent";
+    return `${this.config.baseUrl}:${action}`;
+  }
+
+  buildHeaders(credentials, stream = true) {
+    return {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${credentials.accessToken}`,
+      "User-Agent": geminiCLIUserAgent(this._currentModel),
+      "X-Goog-Api-Client": GEMINI_CLI_API_CLIENT,
+      "Accept": stream ? "text/event-stream" : "application/json"
+    };
+  }
+
+  transformRequest(model, body, stream, credentials) {
+    // Store model for use in buildHeaders (called by base.execute after transformRequest)
+    this._currentModel = model;
+    if (!body.project && credentials?.projectId) {
+      body.project = credentials.projectId;
+    }
+    return body;
+  }
+
+  async refreshCredentials(credentials, log) {
+    if (!credentials.refreshToken) return null;
+
+    try {
+      const response = await fetch(OAUTH_ENDPOINTS.google.token, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: credentials.refreshToken,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        })
+      });
+
+      if (!response.ok) return null;
+
+      const tokens = await response.json();
+      log?.info?.("TOKEN", "Gemini CLI refreshed");
+
+      return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token || credentials.refreshToken,
+        expiresIn: tokens.expires_in,
+        projectId: credentials.projectId
+      };
+    } catch (error) {
+      log?.error?.("TOKEN", `Gemini CLI refresh error: ${error.message}`);
+      return null;
+    }
+  }
+}
+
+export default GeminiCLIExecutor;

package/open-sse/executors/github.js

@@ -0,0 +1,305 @@
+import { BaseExecutor } from "./base.js";
+import { PROVIDERS } from "../config/providers.js";
+import { OAUTH_ENDPOINTS, GITHUB_COPILOT } from "../config/appConstants.js";
+import { HTTP_STATUS } from "../config/runtimeConfig.js";
+import { openaiToOpenAIResponsesRequest } from "../translator/request/openai-responses.js";
+import { openaiResponsesToOpenAIResponse } from "../translator/response/openai-responses.js";
+import { initState } from "../translator/index.js";
+import { parseSSELine, formatSSE } from "../utils/streamHelpers.js";
+import { proxyAwareFetch } from "../utils/proxyFetch.js";
+import crypto from "crypto";
+
+export class GithubExecutor extends BaseExecutor {
+  constructor() {
+    super("github", PROVIDERS.github);
+    this.knownCodexModels = new Set();
+  }
+
+  buildUrl(model, stream, urlIndex = 0) {
+    return this.config.baseUrl;
+  }
+
+  buildHeaders(credentials, stream = true) {
+    const token = credentials.copilotToken || credentials.accessToken;
+    return {
+      "Authorization": `Bearer ${token}`,
+      "Content-Type": "application/json",
+      "copilot-integration-id": "vscode-chat",
+      "editor-version": `vscode/${GITHUB_COPILOT.VSCODE_VERSION}`,
+      "editor-plugin-version": `copilot-chat/${GITHUB_COPILOT.COPILOT_CHAT_VERSION}`,
+      "user-agent": GITHUB_COPILOT.USER_AGENT,
+      "openai-intent": "conversation-panel",
+      "x-github-api-version": GITHUB_COPILOT.API_VERSION,
+      "x-request-id": crypto.randomUUID?.() || `${Date.now()}-${Math.random().toString(36).slice(2)}`,
+      "x-vscode-user-agent-library-version": "electron-fetch",
+      "X-Initiator": "user",
+      "Accept": stream ? "text/event-stream" : "application/json"
+    };
+  }
+
+  // Sanitize messages for GitHub Copilot /chat/completions endpoint.
+  // The endpoint only accepts 'text' and 'image_url' content part types.
+  // Tool-related content (tool_use, tool_result, thinking) must be serialized as text.
+  sanitizeMessagesForChatCompletions(body) {
+    if (!body?.messages) return body;
+
+    const sanitized = { ...body };
+    
+    // Handle response_format for Claude models via GitHub
+    // GitHub's internal translation doesn't respect response_format, so we inject it as a system prompt
+    // AND prepend a reminder to the last user message for maximum effectiveness
+    if (body.response_format && body.model?.includes('claude')) {
+      const responseFormat = body.response_format;
+      let systemInstruction = '';
+      if (responseFormat.type === 'json_schema' && responseFormat.json_schema?.schema) {
+        systemInstruction = 'CRITICAL: You must ONLY output raw JSON. Never use markdown code blocks. Never use backticks. Never wrap JSON in triple backticks. Output ONLY the raw JSON object.';
+      } else if (responseFormat.type === 'json_object') {
+        systemInstruction = 'CRITICAL: You must ONLY output raw JSON. Never use markdown code blocks. Never use backticks.';
+      }
+      if (systemInstruction) {
+        // Add to system message
+        const systemIdx = body.messages.findIndex(m => m.role === 'system');
+        if (systemIdx >= 0) {
+          body.messages[systemIdx].content = systemInstruction + '\n\n' + body.messages[systemIdx].content;
+        } else {
+          body.messages.unshift({ role: 'system', content: systemInstruction });
+        }
+        
+        // Also prepend to the last user message as a reminder
+        const lastUserIdx = body.messages.map((m, i) => m.role === 'user' ? i : -1).filter(i => i >= 0).pop();
+        if (lastUserIdx >= 0) {
+          const userMsg = body.messages[lastUserIdx];
+          const userContent = typeof userMsg.content === 'string' ? userMsg.content : JSON.stringify(userMsg.content);
+          userMsg.content = 'Respond with ONLY raw JSON (no markdown, no backticks, no code blocks): ' + userContent;
+        }
+      }
+    }
+    sanitized.messages = body.messages.map(msg => {
+      // assistant messages with only tool_calls have content: null — leave as-is
+      if (!msg.content) return msg;
+
+      // String content is always fine
+      if (typeof msg.content === "string") return msg;
+
+      // Array content: filter/convert unsupported part types
+      if (Array.isArray(msg.content)) {
+        const cleanContent = msg.content
+          .map(part => {
+            if (part.type === "text") return part;
+            if (part.type === "image_url") return part;
+            // Serialize tool_use, tool_result, thinking, etc. as text
+            const text = part.text || part.content || JSON.stringify(part);
+            return { type: "text", text: typeof text === "string" ? text : JSON.stringify(text) };
+          })
+          .filter(part => part.text !== ""); // remove empty text parts
+
+        // If all content was stripped (e.g. only tool_result with no text), drop content
+        return { ...msg, content: cleanContent.length > 0 ? cleanContent : null };
+      }
+
+      return msg;
+    });
+
+    return sanitized;
+  }
+
+  async execute(options) {
+    const { model, log } = options;
+
+    // Only use /responses for models that are explicitly known to need it (e.g. gpt codex models)
+    if (this.knownCodexModels.has(model)) {
+      log?.debug("GITHUB", `Using cached /responses route for ${model}`);
+      return this.executeWithResponsesEndpoint(options);
+    }
+
+    // Sanitize messages before sending to /chat/completions
+    // This handles Claude models on GitHub Copilot which reject non-text/image_url content types
+    const sanitizedOptions = {
+      ...options,
+      body: this.sanitizeMessagesForChatCompletions(options.body)
+    };
+
+    const result = await super.execute({ ...sanitizedOptions, proxyOptions: options.proxyOptions || null });
+
+    if (result.response.status === HTTP_STATUS.BAD_REQUEST) {
+      const errorBody = await result.response.clone().text();
+
+      if (errorBody.includes("not accessible via the /chat/completions endpoint")) {
+        log?.warn("GITHUB", `Model ${model} requires /responses. Switching...`);
+        this.knownCodexModels.add(model);
+        return this.executeWithResponsesEndpoint(options);
+      }
+    }
+
+    return result;
+  }
+
+  async executeWithResponsesEndpoint({ model, body, stream, credentials, signal, log, proxyOptions = null }) {
+    const url = this.config.responsesUrl;
+    const headers = this.buildHeaders(credentials, stream);
+
+    const transformedBody = openaiToOpenAIResponsesRequest(model, body, stream, credentials);
+
+    log?.debug("GITHUB", "Sending translated request to /responses");
+
+    const response = await proxyAwareFetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(transformedBody),
+      signal
+    }, proxyOptions);
+
+    if (!response.ok) {
+      return { response, url, headers, transformedBody };
+    }
+
+    const state = initState("openai-responses");
+    state.model = model;
+
+    const decoder = new TextDecoder();
+    let buffer = "";
+
+    const transformStream = new TransformStream({
+      async transform(chunk, controller) {
+        buffer += decoder.decode(chunk, { stream: true });
+        const lines = buffer.split("\n");
+
+        buffer = lines.pop() || "";
+
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+
+          const parsed = parseSSELine(trimmed);
+          if (!parsed) continue;
+
+          if (parsed.done && stream === true) {
+            controller.enqueue(new TextEncoder().encode("data: [DONE]\n\n"));
+            continue;
+          }
+
+          const converted = openaiResponsesToOpenAIResponse(parsed, state);
+          if (converted) {
+            const sseString = formatSSE(converted, "openai");
+            controller.enqueue(new TextEncoder().encode(sseString));
+          }
+        }
+      },
+      flush(controller) {
+        if (buffer.trim()) {
+          const parsed = parseSSELine(buffer.trim());
+          if (parsed && !parsed.done) {
+            const converted = openaiResponsesToOpenAIResponse(parsed, state);
+            if (converted) {
+              controller.enqueue(new TextEncoder().encode(formatSSE(converted, "openai")));
+            }
+          }
+        }
+      }
+    });
+
+    if (!response.body) {
+      return { response: new Response("", { status: response.status, headers: response.headers }), url, headers, transformedBody };
+    }
+    const convertedStream = response.body.pipeThrough(transformStream);
+
+    return {
+      response: new Response(convertedStream, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      }),
+      url,
+      headers,
+      transformedBody
+    };
+  }
+
+  async refreshCopilotToken(githubAccessToken, log) {
+    try {
+      const response = await fetch("https://api.github.com/copilot_internal/v2/token", {
+        headers: {
+          "Authorization": `token ${githubAccessToken}`,
+          "User-Agent": GITHUB_COPILOT.USER_AGENT,
+          "Editor-Version": `vscode/${GITHUB_COPILOT.VSCODE_VERSION}`,
+          "Editor-Plugin-Version": `copilot-chat/${GITHUB_COPILOT.COPILOT_CHAT_VERSION}`,
+          "Accept": "application/json",
+          "x-github-api-version": GITHUB_COPILOT.API_VERSION
+        }
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        log?.error?.("TOKEN", `Copilot token refresh failed: ${response.status} ${errorText}`);
+        return null;
+      }
+      const data = await response.json();
+      log?.info?.("TOKEN", "Copilot token refreshed");
+      return { token: data.token, expiresAt: data.expires_at };
+    } catch (error) {
+      log?.error?.("TOKEN", `Copilot refresh error: ${error.message}`);
+      return null;
+    }
+  }
+
+  async refreshGitHubToken(refreshToken, log) {
+    try {
+      const response = await fetch(OAUTH_ENDPOINTS.github.token, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        })
+      });
+      if (!response.ok) return null;
+      const tokens = await response.json();
+      log?.info?.("TOKEN", "GitHub token refreshed");
+      return { accessToken: tokens.access_token, refreshToken: tokens.refresh_token || refreshToken, expiresIn: tokens.expires_in };
+    } catch (error) {
+      log?.error?.("TOKEN", `GitHub refresh error: ${error.message}`);
+      return null;
+    }
+  }
+
+  async refreshCredentials(credentials, log) {
+    let copilotResult = await this.refreshCopilotToken(credentials.accessToken, log);
+
+    if (!copilotResult && credentials.refreshToken) {
+      const githubTokens = await this.refreshGitHubToken(credentials.refreshToken, log);
+      if (githubTokens?.accessToken) {
+        copilotResult = await this.refreshCopilotToken(githubTokens.accessToken, log);
+        if (copilotResult) {
+          return { ...githubTokens, copilotToken: copilotResult.token, copilotTokenExpiresAt: copilotResult.expiresAt };
+        }
+        return githubTokens;
+      }
+    }
+
+    if (copilotResult) {
+      return { accessToken: credentials.accessToken, refreshToken: credentials.refreshToken, copilotToken: copilotResult.token, copilotTokenExpiresAt: copilotResult.expiresAt };
+    }
+
+    return null;
+  }
+
+  needsRefresh(credentials) {
+    // Always refresh if no copilotToken
+    if (!credentials.copilotToken) return true;
+
+    if (credentials.copilotTokenExpiresAt) {
+      // Handle both Unix timestamp (seconds) and ISO string
+      let expiresAtMs = credentials.copilotTokenExpiresAt;
+      if (typeof expiresAtMs === "number" && expiresAtMs < 1e12) {
+        expiresAtMs = expiresAtMs * 1000; // Convert seconds to ms
+      } else if (typeof expiresAtMs === "string") {
+        expiresAtMs = new Date(expiresAtMs).getTime();
+      }
+      if (expiresAtMs - Date.now() < 5 * 60 * 1000) return true;
+    }
+    return super.needsRefresh(credentials);
+  }
+}
+
+export default GithubExecutor;

package/open-sse/executors/iflow.js

@@ -0,0 +1,104 @@
+import crypto from "crypto";
+import { BaseExecutor } from "./base.js";
+import { PROVIDERS } from "../config/providers.js";
+
+/**
+ * IFlowExecutor - Executor for iFlow API with HMAC-SHA256 signature
+ */
+export class IFlowExecutor extends BaseExecutor {
+  constructor() {
+    super("iflow", PROVIDERS.iflow);
+  }
+
+  /**
+   * Generate UUID v4
+   * @returns {string} UUID v4 string
+   */
+  generateUUID() {
+    return crypto.randomUUID();
+  }
+
+  /**
+   * Create iFlow signature using HMAC-SHA256
+   * @param {string} userAgent - User agent string
+   * @param {string} sessionID - Session ID
+   * @param {number} timestamp - Unix timestamp in milliseconds
+   * @param {string} apiKey - API key for signing
+   * @returns {string} Hex-encoded signature
+   */
+  createIFlowSignature(userAgent, sessionID, timestamp, apiKey) {
+    if (!apiKey) return "";
+    const payload = `${userAgent}:${sessionID}:${timestamp}`;
+    const hmac = crypto.createHmac("sha256", apiKey);
+    hmac.update(payload);
+    return hmac.digest("hex");
+  }
+
+  /**
+   * Build headers with iFlow-specific signature
+   * @param {object} credentials - Provider credentials
+   * @param {boolean} stream - Whether streaming is enabled
+   * @returns {object} Headers object
+   */
+  buildHeaders(credentials, stream = true) {
+    // Generate session ID and timestamp
+    const sessionID = `session-${this.generateUUID()}`;
+    const timestamp = Date.now();
+
+    // Get user agent from config
+    const userAgent = this.config.headers["User-Agent"] || "iFlow-Cli";
+
+    // Get API key (prefer apiKey, fallback to accessToken)
+    const apiKey = credentials.apiKey || credentials.accessToken || "";
+
+    // Create signature
+    const signature = this.createIFlowSignature(userAgent, sessionID, timestamp, apiKey);
+
+    // Build headers
+    const headers = {
+      "Content-Type": "application/json",
+      ...this.config.headers,
+      "session-id": sessionID,
+      "x-iflow-timestamp": timestamp.toString(),
+      "x-iflow-signature": signature
+    };
+
+    // Add authorization
+    if (credentials.apiKey) {
+      headers["Authorization"] = `Bearer ${credentials.apiKey}`;
+    }
+
+    // Add streaming header
+    if (stream) {
+      headers["Accept"] = "text/event-stream";
+    }
+
+    return headers;
+  }
+
+  /**
+   * Build URL for iFlow API
+   * @param {string} model - Model name
+   * @param {boolean} stream - Whether streaming is enabled
+   * @param {number} urlIndex - URL index for fallback
+   * @param {object} credentials - Provider credentials
+   * @returns {string} API URL
+   */
+  buildUrl(model, stream, urlIndex = 0, credentials = null) {
+    return this.config.baseUrl;
+  }
+
+  /**
+   * Transform request body (passthrough for iFlow)
+   * @param {string} model - Model name
+   * @param {object} body - Request body
+   * @param {boolean} stream - Whether streaming is enabled
+   * @param {object} credentials - Provider credentials
+   * @returns {object} Transformed body
+   */
+  transformRequest(model, body, stream, credentials) {
+    return body;
+  }
+}
+
+export default IFlowExecutor;